January 2017

On February 21, 2017, the comment period closes for draft guidance issued by the Food and Drug Administration setting a maximum lead content of 10 parts per million (ppm) in cosmetic lip products and externally applied cosmetics. The guidance also applies to shampoos and body lotions, but not to “topically applied products . . . classified as drugs or to hair dyes . . . contain[ing] lead acetate.” The guidance is the FDA’s first foray into setting an acceptable limit for lead concentration in cosmetic products, though FDA scientists have been analyzing the issue for a decade. In its most recent testing, the FDA found that lead levels were below 10 ppm for most of the 685 products tested. The agency noted that modern testing capabilities “enable manufacturers to avoid the purchase of ingredients with unacceptably high levels of lead and to determine whether lead is introduced into their products during the manufacturing process.” While the guidance is a recommendation and not a legally enforceable responsibility, the FDA noted that it is prepared to take enforcement action against cosmetic products that may harm consumers – which, according to the draft guidance, is at some level above 10 ppm. What action the FDA takes with respect not only to enforcement, but to finalizing the guidance, depends on the new administration, which is signaling a possible period of decreased agency action.

The proposed rule is Lead in Cosmetic Lip Products and Externally Applied Cosmetics: Recommended Maximum Level, Docket Number FDA-2014-D-2275. Comments can be submitted electronically here. Instructions on submitting comments using other methods can be found here.

Spokeo, Inc. v. Robbins, 136 S. Ct. 1540 (2016), which many read as elevating the standing requirements for statutory claims, remains an effective tool for class action defense lawyers – at least in some circuits. In other circuits, as we reported here and here, Spokeo has been afforded much less status. The Third Circuit remains circumspect about Spokeo, as it laid out in In re Horizon Healthcare Services, Inc. Data Breach Litigation, ___ F.3d __, 2017 WL 242554 (3d Cir. Jan. 20, 2017). In Horizon, a group of insurance plan participants alleged that Horizon failed, under the Fair Credit Reporting Act (FCRA), to adequately safeguard their personal information, which was stored on laptops stolen from Horizon’s headquarters. The district court dismissed the lawsuit, finding no cognizable injury (and, consequently, no Article III standing) because the plaintiffs failed to adequately allege that the stolen information was actually used to their detriment. The Third Circuit reversed, finding that the unlawful disclosure of legally protected information is “a clear de facto injury.” Spokeo, it reasoned, did not “erect any new barriers” to standing, even “though [an alleged violation] may be based on intangible harms.” Accordingly, the court rejected the “possible . . . read[ing of] Spokeo as creating a requirement that a plaintiff show a statutory violation has caused a ‘material risk of harm’ before he can bring suit.” The court opined that the Supreme Court did not “intend[] to change the traditional standard for the establishment of standing.” It remains to be seen whether the Third Circuit’s approach truly realizes the Supreme Court’s intent.

Long after the disappearance of most video rental stores, the issue of the applicability of the Video Privacy Protection Act (VPPA) in the digital age is not going away. On January 9, the Supreme Court denied certiorari in C.A.F. v. Viacom, Inc., declining to address the Third Circuit’s June 2016 ruling that internet protocol (IP) addresses were not personally identifiable information (PII) protected under the VPPA and settle what some have characterized as a split with the First Circuit.

The VPPA was passed in 1988, following the publication of Supreme Court nominee Robert Bork’s video rental records. It imposes civil liability on any “video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). In re Hulu Privacy Litigation, a case before the Northern District of California, made it clear in 2012 that the VPPA applies in the digital realm and in the world of online content delivery such as the website Hulu.com.

To read the full Jenner & Block client alert on this subject, please click here.

Earlier this month, a federal district court in the Northern District of California held that Facebook could rely on a choice-of-law clause in its terms of service to avoid enforcement of New Jersey’s Truth-in-Consumer Contract, Warranty, and Notice Act (“TCCWNA”), which we have previously discussed on the blog. See Palomino v. Facebook, Inc., no. 16-cv-04230-HSG, 2017 WL 76901 (N.D. Cal., Jan. 9, 2017). This New Jersey law has recently been popular among plaintiffs’ attorneys bringing putative class actions that target online businesses for minor technical violations in their terms of services. Nevertheless, the Palomino case provides hope that businesses can avoid the statute by means of a choice-of-law clause.

Enacted in 1981, the TCCWNA was made with the goal of preventing businesses from tricking consumers with misleading contracts, warranties, and notices. Most notably, the TCCWNA requires companies to explicitly state whether or not provisions in contracts and notices are void in New Jersey, providing as follows: “No consumer contract, notice or sign shall state that any of its provisions is or may be void, unenforceable or inapplicable in some jurisdictions without specifying which provisions are or are not void, unenforceable or inapplicable within the State of New Jersey; provided, however, that this shall not apply to warranties.” N.J.S.A. 56:12-16. Plaintiffs’ lawyers have latched on to this provision because online terms of services often just state that they are “void where prohibited” or words to that effect, and do not spell out exactly which provisions are or are not void in New Jersey.

On January 5, 2017, in one of its first acts in the new year, the FTC filed a complaint in the Northern District of California against Taiwanese manufacturer D-Link Corp. and its US subsidiary (together, D-Link), alleging that D-Link overstated the security of its routers and internet-connected cameras and, at the same time, failed to take reasonable steps to secure those devices from unauthorized access. The lawsuit against D-Link signals the FTC’s continued commitment to police data privacy and security in the fast-developing “Internet of Things” (IoT) space, particularly when a company’s internet-connected product and security designs depart from established best practices.

To read the full Jenner & Block client alert on this subject, please click here.

ConAgra produces Wesson-brand cooking oil, which is labeled “100% Natural.” Plaintiffs filed putative class actions in eleven states alleging that alleged that the term “100% Natural” was false and misleading because Wesson oils are extracted from bioengineered crops and are therefore not “natural.” Those cases were consolidated into a single case in the United States District Court for the Central District of California, and the plaintiffs sought to certify a set of classes consisting of all residents of California, Colorado, Florida, Illinois, Indiana, Nebraska, New York, Ohio, Oregon, South Dakota, or Texas who purchased Wesson cooking oils within the class period. ConAgra opposed class certification on the basis, among others, that “there would be no administratively feasible way to identify members of the proposed classes because consumers would not be able to reliably identify themselves as class members.” The district court certified the class notwithstanding ConAgra’s objections.

ConAgra filed an interlocutory appeal of the class certification order under Rule 23(f). The Ninth Circuit affirmed. Its principal opinion focused exclusively on whether Rule 23 imposes a freestanding “administrative feasibility” requirement. It also addressed ConAgra’s remaining arguments in an unpublished memorandum disposition.

The Tenth Circuit recently reaffirmed that the Class Action Fairness Act (“CAFA”), which authorizes federal jurisdiction over certain class actions where the amount in controversy exceeds $5 million, does not require a showing that class members are likely to recover that amount.

In Hammond v. Stamps.com, Inc., a putative class of plaintiffs sued Stamps.com, which allows users to print their own postage from home without going to a post office, in New Mexico state court for allegedly failing to disclose that a monthly fee applies even in months where users did not print any postage. Stamps.com removed to federal court and offered undisputed evidence that there were over 300,000 customers who called to cancel their subscriptions. Although Stamps.com argued that the amount in controversy was between $10 and $93 million using the plaintiffs’ proposed measure of damages, the district court concluded that Stamps.com failed to show that there was over $5 million in controversy because it had not provided any evidence of the number of customers who cancelled their accounts because they discovered that they had been deceived by the recurring charges.